{
  "schema": "https://ai-atoms.com/schemas/skill-v1.json",
  "type": "skill",
  "id": "skill/linkerd-patterns",
  "version": "1.0.0",
  "name": "Linkerd Patterns",
  "description": "Implement Linkerd service mesh patterns for lightweight, security-focused service mesh deployments. Use when setting up Linkerd, configuring traffic policies, or implementing zero-trust networking ...",
  "system_prompt_fragment": "# Linkerd Patterns\n\nProduction patterns for Linkerd service mesh - the lightweight, security-first service mesh for Kubernetes.\n\n## Do not use this skill when\n\n- The task is unrelated to linkerd patterns\n- You need a different domain or tool outside this scope\n\n## Instructions\n\n- Clarify goals, constraints, and required inputs.\n- Apply relevant best practices and validate outcomes.\n- Provide actionable steps and verification.\n- If detailed examples are required, open `resources/implementation-playbook.md`.\n\n## Use this skill when\n\n- Setting up a lightweight service mesh\n- Implementing automatic mTLS\n- Configuring traffic splits for canary deployments\n- Setting up service profiles for per-route metrics\n- Implementing retries and timeouts\n- Multi-cluster service mesh\n\n## Core Concepts\n\n### 1. Linkerd Architecture\n\n```\n┌─────────────────────────────────────────────┐\n│                Control Plane                 │\n│  ┌─────────┐ ┌──────────┐ ┌──────────────┐ │\n│  │ destiny │ │ identity │ │ proxy-inject │ │\n│  └─────────┘ └──────────┘ └──────────────┘ │\n└─────────────────────────────────────────────┘\n                      │\n┌─────────────────────────────────────────────┐\n│                 Data Plane                   │\n│  ┌─────┐    ┌─────┐    ┌─────┐             │\n│  │proxy│────│proxy│────│proxy│             │\n│  └─────┘    └─────┘    └─────┘             │\n│     │           │           │               │\n│  ┌──┴──┐    ┌──┴──┐    ┌──┴──┐            │\n│  │ app │    │ app │    │ app │            │\n│  └─────┘    └─────┘    └─────┘            │\n└─────────────────────────────────────────────┘\n```\n\n### 2. Key Resources\n\n| Resource | Purpose |\n|----------|---------|\n| **ServiceProfile** | Per-route metrics, retries, timeouts |\n| **TrafficSplit** | Canary deployments, A/B testing |\n| **Server** | Define server-side policies |\n| **ServerAuthorization** | Access control policies |\n\n## Templates\n\n### Template 1: Mesh Installation\n\n```bash\n# Install CLI\ncurl --proto '=https' --tlsv1.2 -sSfL https://run.linkerd.io/install | sh\n\n# Validate cluster\nlinkerd check --pre\n\n# Install CRDs\nlinkerd install --crds | kubectl apply -f -\n\n# Install control plane\nlinkerd install | kubectl apply -f -\n\n# Verify installation\nlinkerd check\n\n# Install viz extension (optional)\nlinkerd viz install | kubectl apply -f -\n```\n\n### Template 2: Inject Namespace\n\n```yaml\n# Automatic injection for namespace\napiVersion: v1\nkind: Namespace\nmetadata:\n  name: my-app\n  annotations:\n    linkerd.io/inject: enabled\n---\n# Or inject specific deployment\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: my-app\n  annotations:\n    linkerd.io/inject: enabled\nspec:\n  template:\n    metadata:\n      annotations:\n        linkerd.io/inject: enabled\n```\n\n### Template 3: Service Profile with Retries\n\n```yaml\napiVersion: linkerd.io/v1alpha2\nkind: ServiceProfile\nmetadata:\n  name: my-service.my-namespace.svc.cluster.local\n  namespace: my-namespace\nspec:\n  routes:\n    - name: GET /api/users\n      condition:\n        method: GET\n        pathRegex: /api/users\n      responseClasses:\n        - condition:\n            status:\n              min: 500\n              max: 599\n          isFailure: true\n      isRetryable: true\n    - name: POST /api/users\n      condition:\n        method: POST\n        pathRegex: /api/users\n      # POST not retryable by default\n      isRetryable: false\n    - name: GET /api/users/{id}\n      condition:\n        method: GET\n        pathRegex: /api/users/[^/]+\n      timeout: 5s\n      isRetryable: true\n  retryBudget:\n    retryRatio: 0.2\n    minRetriesPerSecond: 10\n    ttl: 10s\n```\n\n### Template 4: Traffic Split (Canary)\n\n```yaml\napiVersion: split.smi-spec.io/v1alpha1\nkind: TrafficSplit\nmetadata:\n  name: my-service-canary\n  namespace: my-namespace\nspec:\n  service: my-service\n  backends:\n    - service: my-service-stable\n      weight: 900m  # 90%\n    - service: my-service-canary\n      weight: 100m  # 10%\n```\n\n### Template 5: Server Authorization Policy\n\n```yaml\n# Define the server\napiVersion: policy.linkerd.io/v1beta1\nkind: Server\nmetadata:\n  name: my-service-http\n  namespace: my-namespace\nspec:\n  podSelector:\n    matchLabels:\n      app: my-service\n  port: http\n  proxyProtocol: HTTP/1\n---\n# Allow traffic from specific clients\napiVersion: policy.linkerd.io/v1beta1\nkind: ServerAuthorization\nmetadata:\n  name: allow-frontend\n  namespace: my-namespace\nspec:\n  server:\n    name: my-service-http\n  client:\n    meshTLS:\n      serviceAccounts:\n        - name: frontend\n          namespace: my-namespace\n---\n# Allow unauthenticated traffic (e.g., from ingress)\napiVersion: policy.linkerd.io/v1beta1\nkind: ServerAuthorization\nmetadata:\n  name: allow-ingress\n  namespace: my-namespace\nspec:\n  server:\n    name: my-service-http\n  client:\n    unauthenticated: true\n    networks:\n      - cidr: 10.0.0.0/8\n```\n\n### Template 6: HTTPRoute for Advanced Routing\n\n```yaml\napiVersion: policy.linkerd.io/v1beta2\nkind: HTTPRoute\nmetadata:\n  name: my-route\n  namespace: my-namespace\nspec:\n  parentRefs:\n    - name: my-service\n      kind: Service\n      group: core\n      port: 8080\n  rules:\n    - matches:\n        - path:\n            type: PathPrefix\n            value: /api/v2\n        - headers:\n            - name: x-api-version\n              value: v2\n      backendRefs:\n        - name: my-service-v2\n          port: 8080\n    - matches:\n        - path:\n            type: PathPrefix\n            value: /api\n      backendRefs:\n        - name: my-service-v1\n          port: 8080\n```\n\n### Template 7: Multi-cluster Setup\n\n```bash\n# On each cluster, install with cluster credentials\nlinkerd multicluster install | kubectl apply -f -\n\n# Link clusters\nlinkerd multicluster link --cluster-name west \\\n  --api-server-address https://west.example.com:6443 \\\n  | kubectl apply -f -\n\n# Export a service to other clusters\nkubectl label svc/my-service mirror.linkerd.io/exported=true\n\n# Verify cross-cluster connectivity\nlinkerd multicluster check\nlinkerd multicluster gateways\n```\n\n## Monitoring Commands\n\n```bash\n# Live traffic view\nlinkerd viz top deploy/my-app\n\n# Per-route metrics\nlinkerd viz routes deploy/my-app\n\n# Check proxy status\nlinkerd viz stat deploy -n my-namespace\n\n# View service dependencies\nlinkerd viz edges deploy -n my-namespace\n\n# Dashboard\nlinkerd viz dashboard\n```\n\n## Debugging\n\n```bash\n# Check injection status\nlinkerd check --proxy -n my-namespace\n\n# View proxy logs\nkubectl logs deploy/my-app -c linkerd-proxy\n\n# Debug identity/TLS\nlinkerd identity -n my-namespace\n\n# Tap traffic (live)\nlinkerd viz tap deploy/my-app --to deploy/my-backend\n```\n\n## Best Practices\n\n### Do's\n- **Enable mTLS everywhere** - It's automatic with Linkerd\n- **Use ServiceProfiles** - Get per-route metrics and retries\n- **Set retry budgets** - Prevent retry storms\n- **Monitor golden metrics** - Success rate, latency, throughput\n\n### Don'ts\n- **Don't skip check** - Always run `linkerd check` after changes\n- **Don't over-configure** - Linkerd defaults are sensible\n- **Don't ignore ServiceProfiles** - They unlock advanced features\n- **Don't forget timeouts** - Set appropriate values per route\n\n## Resources\n\n- [Linkerd Documentation](https://linkerd.io/2.14/overview/)\n- [Service Profiles](https://linkerd.io/2.14/features/service-profiles/)\n- [Authorization Policy](https://linkerd.io/2.14/features/server-policy/)",
  "applicable_domains": [
    "other"
  ],
  "category": "other",
  "invocation": [
    "/linkerd-patterns"
  ],
  "authored_by": "claudeskills.in community",
  "source_url": "https://claudeskills.in/skill/linkerd-patterns",
  "provenance": {
    "source": "claudeskills.in",
    "source_url": "https://claudeskills.in/skill/linkerd-patterns",
    "license": "unknown",
    "imported_at": "2026-09-03",
    "notes": "Aggregated by claudeskills.in from community GitHub lists."
  },
  "tags": [
    "claudeskills",
    "other"
  ],
  "lifecycle": "draft"
}